What Russia Wants in Regulating the IT Field

In March, Russian foreign minister Sergey Lavrov convincingly and determinedly wrote about Russia’s historical greatness and emphasised that sustainable politics is not possible without basing decisions on history.¹ This approach is not new in itself. Russia’s imperialist desires have been evident in the state’s behaviour for centuries and it would be erroneous to think that the Russians do not use the same logic in issues concerned with IT. Even though they adamantly claim not to want a conflict with the US, NATO or the European Union and that they are ready for cooperation, these wishes have so far not turned into reality and remain a reflection of the disparity between Russia’s words and actions that we have experienced before. Moreover, according to the current military doctrine, NATO and the US are unequivocally identified as Russia’s main enemies since the Allies are the main actors obstructing Russia’s plan to restore its empire, at least within the borders of the former Soviet Union.
The subject of protecting information available through information technology became relevant to Russia during the Arab Spring, when the existence of the internet substantially influenced the emergence of the revolution. Russia has been issuing statements about the IT field especially boldly and actively since the Snowden affair, emphasising the importance of protecting sensitive information.
Today, with Russia sinking deeper and deeper into economic crisis,² the Russians have started to use the field of information technology quite skilfully. Information and psychological operations have a very important role in preparing and organising combat activity in view of the military doctrine adopted in 2014, and the operations are considered a cheap and good method for influencing an opponent. On the other hand, Russia sees the information space as a (military) threat to the state’s internal stability as it allows the population to be influenced and Russian convictions and traditions (historical, patriotic, etc.) to be undermined. The internet is the key factor through which Russia is planning to influence the enemy in the international information space.
Thus, protecting information and information security has become an important issue for the Russian Federation; it is becoming increasingly more centralised and is constantly being developed. The West’s opinions on this matter are, however, not accepted, and the decades-long “arms race” has smoothly transferred to the field of IT.
Despite its economic difficulties, Russia plans to strengthen its IT capabilities, especially in the armed forces.³ While the country’s general defence expenditure will be reduced by 5% in 2016, information technology is being further developed and has become one of the Kremlin’s most effective tools. Lieutenant General Ben Hodges, commanding general of the United States Army Europe, has called Russia’s electronic military technology “eye-watering”; the US Director of National Intelligence, James Clapper, considers the cyber threat posed by Russia more extensive and greater than that of China. Russian hackers have allegedly managed to break into the information systems of the White House, including the president’s schedule, and tested the vulnerability of US infrastructure.⁴
We cannot exactly talk of a “cyber field” in the Russian context since Russian leaders clearly categorise cyber capability within the wider area of information technology. Events in Ukraine, where cyber operations are just a part of information warfare, illustrate this well.⁵ Russia uses information technology skilfully and has cunningly integrated it into its activities, integrating both its technological and psychological aspects.
The internet is seen as a tool with which the Western world, led by the US, tries to organise coups in non-democratic states. Moscow thinks that Washington is trying to implement changes in regions that belong to Russia’s sphere of interest behind the smokescreen of democratisation. Both the Arab Spring and the “colour” revolutions have been described as US instruments for achieving global domination. Russia sees the West’s support for democratic activities and oppositions as a strategy through which the opponent is trying to curb Russia’s power and capability in the international arena.
Russia’s way of thinking and the Realpolitik based on it is therefore largely based on the principles of the realism school, as Russia highly values the popular 20th-century [or rather 19th-century–Ed.] term “balance of power”, whereas the scales must always be tilted in favour of the Russian side.

Information Protection in Russia

Owing to the fundamental differences in defining and interpreting the field of information technology, the Western and Russian views on information protection and security also differ.
While Western governments primarily talk of cyber security in terms of protecting their own digitised state assets (e.g. electronic elections from interference and unwanted influence; the intranets of government departments and other state bodies; personal data, etc.), Russia sees information security as protecting information per se, which includes the state closing down “bad” websites, restricting freedom of expression and controlling freedom of speech, first and foremost in cyberspace. According to Russian rhetoric, the exchange of information needs to be restricted so as to protect people and their rights.
In Russia a state-controlled body called Roskomnadzor organises information protection, oversees media channels, and regulates and censors the internet. This so-called watchdog also has a blacklist of web pages that are seen as dangerous for Russia for one reason or another. The list mainly consists of pages that spread anti-government messages, Pussy Riot-style videos or “homosexual propaganda,” but parts of Wikipedia, YouTube and Google are also on the list.⁶
Although President Vladimir Putin claims that Russia has no intention of gaining control over the internet, his behaviour is the opposite. Russia justifies restricting internet use as a way of protecting citizens from dangerous foreign information. The media, social media and blogs can influence the masses, and if they exist quite freely they may have a disastrous impact on the state. Russia firmly believes that controlling the mass media protects citizens from false information.⁷ Blogs have been deemed especially dangerous and those with more than 3,000 followers must officially register their activity. A big problem is that ordinary citizens only inhabit the domestic information space and as a result only see the Kremlin’s version of events on the internet. Their information space mainly consists of the social network Vkontakte, search engine Yandex and e-mail service mail.ru.⁸ The Russian propaganda machine is well oiled, which is eloquently illustrated by opinion polls claiming that half of the Russian population agrees that the internet must be censored. They also believe that foreign countries use the internet to harm Russia and that this is a threat to political stability. Half of the population also believes that the internet must be controlled by the Russian government to maintain political stability due to the content of blacklisted web pages.⁹
As of September 2015 all companies active in Russia are required to maintain the data of their Russian clients on servers located on Russian territory.¹⁰ Let us take this with a grain of salt—although Facebook, Apple and Google have not yet fulfilled this requirement, they must do so pursuant to the new law if they wish to continue their activity in Russia. Storing data on Russian territory would create a good opportunity for Russia to control all that information. The situation in Ukraine, where many important sites were hosted on Russian servers and could therefore be directly controlled by the FSB, is an analogous example.^{11, 12}

“Controlling” Information Technology on an International Level

Russia also sees the uncontrolled spread of information on the internet and information technology in general as a serious threat to state security on the international level. This is why it wants to express opinions on the matter and achieve its agenda. At the international level, Russia has mainly spoken about the issue at the UN, which is understandable, as Russia does not belong to any other organisation together with the Western states. Moreover, Russia also needs the support of countries that are “on the same side”, which is easiest to achieve in the UN.
Since 1998 Russia has submitted various proposals and drafts for amending UN resolutions so that the organisation would adopt specific measures to guarantee information security and prevent cyber warfare. However, as mentioned earlier, Russia understands these concepts somewhat differently from the West. Russia’s active work in the UN in this field can, rather, be linked to attempts to curb the spread of US power, as Russia is worried about revolutions started on the internet. First and foremost, the state is trying to stop the US from supporting such uprisings. If Russia gained control over information technology, this might prevent revolutions through government-controlled websites and information.
Russia believes that the internet and the spread of information through it should be nation-specific (not international, as the West sees it) and subject to the respective state’s jurisdiction.¹³ Any other situation would pose a threat to the state’s sovereignty. Russia says that failure to restrict the internet causes an increase in violations of human rights online and prevents states from managing cybercrime. This is the main point that Russia is trying to put across at the UN about the international regulation of IT. Cooperation with states belonging to the Shanghai Cooperation Organisation (SCO), CIS and Collective Security Treaty Organization (CSTO) is considered the key factor in achieving this.
Western governments have regulated cyber security through existing international law and do not see the need to adopt entirely new laws. The Tallinn Manual on the International Law Applicable to Cyber Warfare,¹⁴ published by the NATO Cooperative Cyber Defence Centre of Excellence, has been labelled by the Russian media as a potential threat,¹⁵ since the official position of the Russian Federation favours a complete ban on cyber weapons in international relations as the Russians think that this publication could help to legitimate cyber warfare. No Russian researchers or experts were involved in preparing the publication, which is why the Russian media have criticised the contents a great deal, as they have argued that no new international rules should be introduced without Russian participation.
The US–Russia cybersecurity agreement entered into in 2013, the purpose of which is to guarantee cyber security jointly, can be also deemed relevant on an international level.¹⁶ This cooperation helped to create several allegedly safe channels between the governments so that they could contact one another in case of danger or attack and react together. At the same time, such cooperation might allow Russia to easily gain access to US defence plans, for example, if the US ignored Russia’s “bad” cyber behaviour. US intelligence has already uncovered a strategic cyber intelligence unit connected to the Russian government that has been probing the vulnerability of US economic, government and other critical infrastructure units. The US believes that Russia is preparing for a potential future cyberattack.¹⁷ But this is only a part of Russia’s IT arsenal.
In 2015 Russia entered into a bilateral agreement with China in which cooperation and exchange of information are complemented by presenting a united front at the UN. Russia and China have common interests in this matter, and their interpretation of the IT issue is worlds away from that of the West.

Skilful Use of IT in Backing Strategic Interests

Russia’s rhetoric on cooperation with the US and other Western states in building an efficient cyber-defence system is the opposite of what the world learnt from documents leaked in 2011. These revealed that Russia was clearly developing cyberattack capabilities, including equipment and software that damages electronic devices, tools that allow data to be collected from the “enemy’s” information systems, software that allows memory modules to be overwritten and/or deleted or communication networks to be taken down and turned off, and control systems to be switched off and their algorithms changed; developing the capability to implement a new algorithm in a specific information system,¹⁸ and to change and control buildings’ security systems; developing devices intended to redirect internet connections, and create resources to support extensive cyber warfare.¹⁹ However, this is only one part of Russian IT activity. Potential cyberattacks and paralysing enemy software are complemented by distorting the spread of information in cyberspace and disseminating propaganda.
Russia’s main purpose is to gain global control over information technology and through this restore its historical empire. Dominating the West has always been on the Russian agenda and its imperialist intentions have not disappeared. IT seems to be the means by which Russia could overpower the Western states. Russian cyber capability and activity in IT has grown quickly, which is why the Western governments and, primarily, NATO should start developing the field more vigorously and stop underestimating Russia.
Russia says that it wants to cooperate with the West and create an international legal basis to punish the organisers of cyberattacks and protect information effectively, but the reality is that the Kremlin is even refusing to sign the Council of Europe’s Convention on Cybercrime, which is open to all states and is one of the most promising documents to be prepared in this field. If Russia were to sign the document, the West could probably hold Russia liable for many a cyberattack.
As I said earlier, technology and cyberattacks are not the only components of the Russian IT arsenal—a wider range of activities, such as propaganda and psychological influence, also form part of it. While Europe is more unstable than it has ever been, Russia has found a window of opportunity that it uses skilfully. A weaker Europe and NATO are good for Russia, as it can achieve its objectives; in today’s world, where IT is at the heart of many important developments, Russia can use the field for its own interests. One of its main purposes is to secure its strategic imperialist interests and increase its influence in the former territories of the Soviet Union. As Russia cannot control or restrict the spread of information on the internet outside its territory, it tries to present its version of events in online forums and the comment sections of news portals in addition to traditional media channels. A good example is the fear of refugees that was created in Estonia with the help of Russian propaganda that the ordinary citizen did not perceive as such; refugees have consequently come to be seen as a real threat. Given that Russia sees IT as involving everything connected to cyberspace, achieving such a result is also a step ahead in regulating the field in other states besides Russia. Taking into account Russia’s historical desire to dominate the West, and the state’s economic situation and military capability compared to NATO, the expert manipulation of information technology is a good way of achieving Russia’s aims.
______
¹ Sergey Lavrov, “Russia’s Foreign Policy: Historical Background”. Russia in Global Affairs, 3 March 2016.
² See, e.g., Kathrin Hille, “Russia: Putin’s balance sheet”. Financial Times, 7 April 2016. http://www.ft.com/cms/s/0/cbeae0fc-f048-11e5-9f20-c3a047354386.html#axzz44q94yMfR ³ Eugene Gerden, “Russia to spend $250m strengthening cyber-offensive capabilities”. SC Magazine UK, 4 February 2016. http://www.scmagazineuk.com/russia-to-spend-250m-strengthening-cyber-offensive-capabilities/article/470733/ ⁴ Josh Cohen, “Do not underestimate the Russian military”. The Intersection Project: Russia/Europe/World, 8 January 2016. http://intersectionproject.eu/article/security/do-not-underestimate-russian-military ⁵ Keir Giles, “Russia’s ‘New’ Tools for Confronting the West: Continuity and Innovation in Moscow’s Exercise of Power”. Chatham House, The Royal Institute of International Affairs, March 2016.
⁶ Yekaterina Sinelischikova, “Why Russians support Internet censorship”. Russia Beyond The Headlines (RBTH) [Rossiyskaya Gazeta], 22 August 2015. http://rbth.com/society/2015/08/22/why_russians_support_internet_censorship_48679.html ⁷ For detailed discussion, see “Интервью Александра Жарова: к онлайн-играм нужен особый подход”, 17 February 2016 Юлия Воронина, Татьяна Шадрина (Federal Service for Supervision of Communications, Information Technology and Mass Media). https://rkn.gov.ru/news/rsoc/news37788.htm ⁸ Andrei Soldatov, “Открывая мир, Интернет и политические изменения в России” (“The Internet and Political Change in Russia”). Foreign Affairs, 6 April 2016, https://www.foreignaffairs.com/articles/2016-04-06 ⁹ See, e.g., Erik Nisbet with the Center for Global Communication Studies and the Russian Public Opinion Research Center “Benchmarking Public Demand: Russia’s Appetite for Internet Control”, February 2015.
¹⁰ Viktoria Zavyalova, “Personal data storage in Russia: Challenges of compliance with new laws”. RBTH, 30 March 2016.
http://rbth.com/science_and_tech/2015/03/30/personal_data_storage_in_russia_challenges_of_compliance_wit_44871.html ¹¹ See, e.g., Anna Poludenko, Young, Ukrainian Officials, Russian Security Services Thank You for Your Cooperation! – Global Voices, 23 May 2015: http://globalvoicesonline.org/2015/05/23/ukrainian-officials-russian-security-services-thank-you-for-your-cooperation/ ¹² Giles, “Russia’s ‘New’ Tools for Confronting the West”.
¹³ The point is that the content of web pages may be subject to a jurisdiction to some extent but the internet as such is not influenced by state borders—one can browse websites created in another country, etc.
¹⁴ Available at: http://issuu.com/nato_ccd_coe/docs/tallinnmanual?e=5903855/1802381 ¹⁵ Елена Черненко, Виртуальный фронт, 27 May 2013: http://www.kommersant.ru/doc/2193838 ¹⁶ Elizabeth Simson, “The U.S.–Russia Cybersecurity Pact: Just Paper”. The Daily Signal, 21 June 2013. http://blog.heritage.org/2013/06/21/the-u-s-russia-cyber-pact-just-paper/ and Eugene Gerden, “Russia and U.S. to resume cybersecurity cooperation”. SC Magazine, 30 March 2016:
http://www.scmagazine.com/russia-and-us-to-resume-cybersecurity-cooperation/article/486235/ ¹⁷ “U.S. intelligence identifies Russian firm testing cyber vulnerabilities in critical American infrastructure”. CyberWar.news, 28 December 2015. http://www.cyberwar.news/2015-12-28-u-s-intelligence-identifies-russian-firm-testing-cyber-vulnerabilities-in-critical-american-infrastructure.html ¹⁸ When the “enemy” is performing his everyday tasks and sends data to a specific location, the “interference” directs the data to a location specified by the person who changed the algorithm and the “enemy” might not be immediately aware of this, e.g. when they do not have a corresponding protection system.
¹⁹ William Slater, “A Brief Analysis of Russian Cyberwarfare Capabilities – Past, Present, and Future”, Bellevue University, 2012.

This article was published in ICDS Diplomaatia magazine.